second time's already the charm | A Tester's Journey: Open Security Conference 2025 - Marvelous Momentum www.lisihocke.com/2025/10/open... #osco #osco25

Huge thanks to everyone for coming and contributing and sharing so much invaluable feedback - this gives more energy than you might realize. Lots of love also for my fellow organizers to make this unique event called #osco happen! My heart is full. ❤️ 2/2

Last lunch conversation was had, last train ride was shared. Now #osco25 is slowly starting to fade out and form fond memories. What a wonderful time we had together the last four days. 1/2

Continued with me giving a super relaxed version of my workshop "Secure Development Lifecycle Applied - How to Make Things a Bit More Secure than Yesterday Every Day". Seems folks had fun practicing together. 🎉 #osco gave just the right space and crowd for it. 2/2

Wow. Even the last morning of #osco25 was enlightening. 💡 Started with insightful breakfast conversations on company cultures and reward systems driving behavior. 1/2

On the last leg of my journey, got all trains, left roughly on time and now omw back to Berlin from #osco25. Had a blast, thank you to everyone, you created a truly unique event!

On my way back home after an amazing (prolonged) weekend at @OSCo. It was wonderful connecting with new faces, deepening existing relationships, and gaining valuable insights through exchange and discussion. A huge thank you to the organizing team, the hotel […] [Original post on chaos.social]

Yes. Yes, you've seen correctly. There's going to be an Open Security Conference 2026! 😍 🗓 Save the dates: November 5-8, 2026. ✅ opensecurityconference.org #osco #osco26 #CyberSecurity #Security #InfoSec #AppSec #ProductSecurity #OTsecurity #OpenSpace [lisi]

It's a wrap. Yes, that's it. The Open Security Conference 2025 is officially over. 😌 1/3

It's the last day, the last morning of the Open Security Conference 2025. We've learned so much together these days. Now's the time to go deeper into some of those topics, spend the rest of the time for networking, relax and breathe this community spirit. 1/2

Finally, finished the day with playing games and having great conversations. 💜 Very grateful for such a kind human crowd. And based on the feedback received so far, it wasn't only me having a great time at #osco! 🤩 4/4

Had great company at dinner and hence respective conversations. Of course, in the evening I gave another session of "Capture the flag Together" going on exploration into a system, and again many folks were eager to find these hidden secrets. 3/4

Joined really great sessions, on using OSINT for good, on deception, on hacking tools. My co-conspirator Martin Schmidt offered people to playtest our little security card game - lots of fun and invaluable feedback. 2/4

What an awesome second #OpenSpace day at #osco25! Mine started with a session from us organizers to gather feedback for #osco26 from folks - they shared lots of good ideas we can build on. 💡 1/4

#osco25 is great! Got up to have my breakfast at noon at the bar, around 1pm the lunch was served, now back to the bar for some cake :'-D

That was so fast - the second open space at the Open Security Conference 2025 is already coming to an end. We're all coming together to reflect, think about sessions for the evening and also our last day tomorrow. Well, it's not over yet! 💜 opensecurityconference.org #osco #osco25 [lisi]

Aaaaand it's another full day of open space at the Open Security Conference 2025! Participants just started to present their session ideas for today. 1/2

The perfect closing for the day: chilling at the bar, trying ourselves at lockpicking. 🔓 So glad I finally had this opportunity! What an insightful and enjoyable day at #osco. 💜 3/3

Gave my "Capture the Flag Together" session, twice. The beginners edition in the afternoon was already so cool, introducing these puzzle learning challenges to more folks. Yet at the evening's adventurers edition we really smashed it! Had so much fun with finding these flags. 😁 2/3

This was such a blast. Had a wonderful #OpenSpace day at #osco25. So many awesome people in one place, all interested in #cybersecurity & learning together. ✨ Joined great knowledge exchange sessions on spreading cybersecurity awareness, the Fediverse, security champions struggles & wins. 💡 1/3

#osco25 is the first conference where I'd have better fixed my sleep schedule before attending... rather than the conf itself being the reason for the messed up schedule. Although tbf, my sleep is always a mess :'-D Slowly getting out of bed and trying to pretend to be alive ^^' Yesterday was […]

What a day. Already learned so much from this crowd - "be ready to be surprised" really holds true every time at #OpenSpace conferences like ours! 🌟 Off for dinner, afterwards the evening fun will start. 😁 opensecurityconference.org #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Some hints on candid communication: framing of mistakes is crucial. Stop looking for the guilty. How can we be notified faster? Demonstrated fallibility in regard of our own mistakes. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

The audience continues: Do we even want to admit we make mistakes? Trust is a core theme. Too much trust can be dangerous as well though. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

The audience shared retros, non-violent communication helps - yet any tools fail without building safe interpersonal relationships. Just culture focuses on system and actions not people. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

How can we achieve a more candid environment, for our organizations as well as tech in general? That's the core question to figure out, so let's exchange experiences. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Mistakes in information security will repeat themselves without an environment that enables change for the better. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Google's Aristotle research showed psychological safety is the key factor. Strong team culture correlated with each member's perception of the consequences of taking interpersonal risks. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Errors grow the later you tackle them - especially in information security. "We are establishing a better error culture" is a typical claim after something fails. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Repeating mistakes is not a tech problem. It's a human problem. We fail at admitting mistakes. However, we're quite good at learning from other people's mistakes. 💡 ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Let's come back to the German electronic health record. Well. We'd have hoped we'd learned from past mistakes. And yet: the authentication flow was again bypassed in April 2025. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

We learned not to reveal sensitive info in search engines. Then came chat bots... repeating history. LLMs... again repeating history, e.g. buffer overflow style. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

SQL injection was first time mentioned in 1998 in Phrack magazine. Then came OWASP Top 10, raising awareness. Injections evolved since then. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

We have tooling around authentication for a long time, so one should think we know how to do this. But there are also principles to consider. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

The funny thing about the German electronic health card record? An unsigned object got sent over the wire. 🫠 7 million electronic health records were exposed this way. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

The authentication problem grew more complex with computers. Tried passwords, found troublesome as they could be easily leaked. Physical tokens? First smart card came out in 1979. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Security mistakes throughout history + put all their mitigations together = better security over time? ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Theory: We probably have already found a mitigation for most current security issues somewhere in history. ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Did you know you can find the first traces that people used some kind of multi-factor authentication already before 1050 BC?! ———  📜 History repeating itself - Bianca Kastl  #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Our second keynote is about to start! So happy that Bianca Kastl made it to the Open Security Conference 2025. We can't wait to learn from her analysis on "History repeating itself". 📜 opensecurityconference.org/conference/k... #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

Oh wow, look at this program packed full of awesomeness! And it's just the first open space day. More goodness to come! 😍 opensecurityconference.org #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec #ProductSecurity #OTsecurity #OpenSpace [lisi]

Good morning everyone to the first #OpenSpace day of the Open Space Conference 2025! We literally can't wait what program we'll co-create together today. We're all set up for good things to happen! ✨ opensecurityconference.org #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec [lisi]

What an awesome crowd! The first evening at the Open Space Conference 2025 was a blast. ☺️ While the official program ended, it's perfect time now to hang out and get to know a few folks. Or just relax and rest. Or take a night walk. Or whatever is right for you right now 😉 #osco #osco25 [lisi]

Give visibility to champions and encourage volunteers. Bring security closer to teams and foster a culture of shared knowledge. ———  🏗 Building an AppSec Program from Scratch - Mireia Cano #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec #ProductSecurity [lisi]

Clear expectations and structured onboarding for security champions really helped, including sharing security baseline knowledge. ———  🏗 Building an AppSec Program from Scratch - Mireia Cano #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec #ProductSecurity [lisi]

Security champions know the context of their team, invaluable. Monthly meetings, 1 to 1 sessions, security seminars. Share knowledge and build relationships. ———  🏗 Building an AppSec Program from Scratch - Mireia Cano #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec #ProductSecurity [lisi]

Lots of questions for Mireia! People are curious to hear more & share their experiences as well - especially on security champions & how to have them succeed. ———  🏗 Building an AppSec Program from Scratch - Mireia Cano #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec #ProductSecurity [lisi]

Do you know this situation where you feel like every tool has improved besides the one that you chose? ———  🏗 Building an AppSec Program from Scratch - Mireia Cano #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec #ProductSecurity [lisi]

Security champions embedded in each domain to bridge gaps. This transformation didn't happen overnight, and it's a never-ending journey. ———  🏗 Building an AppSec Program from Scratch - Mireia Cano #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec #ProductSecurity [lisi]

Security is no longer enforced through gates, teams own their security. Metrics and dashboards enable teams to track progress towards their goals. ———  🏗 Building an AppSec Program from Scratch - Mireia Cano #osco #osco25 #CyberSecurity #Security #InfoSec #AppSec #ProductSecurity [lisi]